Skip to content

[TT-17173] apidef classic schema: declare security_requirement_scopes#8253

Merged
lghiur merged 1 commit into
masterfrom
TT-17173-schema-security-requirement-scopes
May 27, 2026
Merged

[TT-17173] apidef classic schema: declare security_requirement_scopes#8253
lghiur merged 1 commit into
masterfrom
TT-17173-schema-security-requirement-scopes

Conversation

@lghiur

@lghiur lghiur commented May 27, 2026 •
edited by github-actions Bot
Loading

Copy link
Copy Markdown
Collaborator

Summary

The APIDefinition struct emits security_requirement_scopes (json tag on []map[string][]string, paired by index with security_requirements to preserve per-scheme scope arrays from OAS root security:). The classic apidef JSON schema didn't declare the property, and the root carries additionalProperties: false, so every API definition carrying the field was rejected by the dashboard's PUT/POST /api/apis validator with:

API object validation failed.
Errors: ["security_requirement_scopes: Additional property security_requirement_scopes is not allowed"]

This blocks the TT-17173 dashboard companion PR — TestAPIContext_OAS/update/oas_api/with_oas, …/with_old, …/with_old/bad_oas all fail post-merge for that reason.

Change

  • apidef/schema.json — declare security_requirement_scopes as type: [array, null] of objects whose additionalProperties is a [array, null] of strings (matches the Go field shape []map[string][]string).
  • apidef/api_definitions_test.go — TestSchema_SecurityRequirementScopes pins a populated DummyAPI() through Validate(Schema, …), so future schema/struct drift fails fast.

Story

Companion PRs

Test plan

  • go test ./apidef/... — clean across all 10 packages
  • TestSchema_SecurityRequirementScopes fails on pre-fix tree with the same Additional property … is not allowed message the dashboard CI surfaces, passes after the schema delta

Risk

Additive schema entry; no behaviour change for callers that don't populate the field. The [array, null] typing and additionalProperties shape mirror the neighbouring security_requirements block.

🤖 Generated with Claude Code

Ticket Details

TT-17173
Status Merge
Summary OAuth2 scope check — global / API level

Generated at: 2026-05-27 12:18:28

@lghiur @claude
[TT-17173] apidef classic schema: declare security_requirement_scopes
b612be4 
The APIDefinition struct emits security_requirement_scopes
(json tag on []map[string][]string, paired by index with
security_requirements to preserve per-scheme scope arrays from
OAS root security:). The classic apidef JSON schema didn't
declare the property, and the root carries additionalProperties:
false, so every API definition carrying the field was rejected
at validation with "Additional property security_requirement_scopes
is not allowed".

Declares the property as type [array, null] of objects whose
additionalProperties is a [array, null] of strings, matching the
Go field shape. TestSchema_SecurityRequirementScopes pins a
populated DummyAPI() through Validate(Schema, …) so future
struct/schema drift fails fast.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
@github-actions

github-actions Bot commented May 27, 2026

Copy link
Copy Markdown
Contributor

🚨 Jira Linter Failed

Commit: b612be4
Failed at: 2026-05-27 12:18:31 UTC

The Jira linter failed to validate your PR. Please check the error details below:

🔍 Click to view error details 
failed to validate Jira issue: jira ticket TT-17173 has status 'Merge' but must be one of: In Dev, In Code Review, Ready For Dev, Dod Check

Next Steps

  • Ensure your branch name contains a valid Jira ticket ID (e.g., ABC-123)
  • Verify your PR title matches the branch's Jira ticket ID
  • Check that the Jira ticket exists and is accessible

This comment will be automatically deleted once the linter passes.

@probelabs

probelabs Bot commented May 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR updates the classic API definition JSON schema to declare the security_requirement_scopes property. This resolves a validation error in the Tyk Dashboard that occurred when creating or updating APIs containing this field, which is necessary for full OAS security definitions. A new test case is also added to prevent future regressions by validating an API spec with this field against the updated schema.

Files Changed Analysis

  • apidef/schema.json: The security_requirement_scopes property is added to the root of the API definition schema. It's defined as a nullable array of objects, mirroring the structure of the corresponding Go type []map[string][]string.
  • apidef/api_definitions_test.go: A new test, TestSchema_SecurityRequirementScopes, is introduced. It populates the SecurityRequirementScopes field on a dummy API definition and validates it against the schema to confirm the fix.

Architecture & Impact Assessment

  • Accomplishment: Fixes a schema validation bug that blocked saving API definitions with OAuth scopes defined at the root security level, a feature required by a companion PR in the tyk-analytics repository.
  • Technical Changes: The primary change is additive to the JSON schema. There are no logic changes to the gateway's behavior.
  • Affected Components: The change primarily impacts the API management and validation layer, specifically the Tyk Dashboard (tyk-analytics) which uses this schema to validate API definitions on create/update operations. The gateway's core proxy functionality is unaffected.

Scope Discovery & Context Expansion

The change is localized to the apidef package, which defines the structure and validation rules for Tyk's classic API definitions. The SecurityRequirementScopes field in apidef/api_definitions.go is part of the main APIDefinition struct and is intended to store security scopes from an OAS definition. This PR ensures that when this field is populated, the resulting API definition object correctly validates against its JSON schema, which is a crucial step for interoperability with the Tyk Dashboard.

References

  • apidef/api_definitions.go: Defines the APIDefinition struct containing the SecurityRequirementScopes field.
Metadata
  • Review Effort: 1 / 5
  • Primary Label: bug

Powered by Visor from Probelabs

Last updated: 2026-05-27T12:19:05.999Z | Triggered by: pr_opened | Commit: b612be4

💡 TIP: You can chat with Visor using /visor ask <your question>

@probelabs

probelabs Bot commented May 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

✅ Security Check Passed

No security issues found – changes LGTM.

✅ Architecture Check Passed

No architecture issues found – changes LGTM.

✅ Performance Check Passed

No performance issues found – changes LGTM.

Powered by Visor from Probelabs

Last updated: 2026-05-27T12:19:00.215Z | Triggered by: pr_opened | Commit: b612be4

💡 TIP: You can chat with Visor using /visor ask <your question>

@github-actions

github-actions Bot commented May 27, 2026

Copy link
Copy Markdown
Contributor

Swagger Changes

     _        __  __
   _| |_   _ / _|/ _|  between swagger-prev.yml
 / _' | | | | |_| |_       and swagger-current.yml
 \__,_|\__, |_| |_|   returned no differences
| (_| | |_| |  _|  _|

@sonarqubecloud

sonarqubecloud Bot commented May 27, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@lghiur
lghiur merged commit 94cc57e into master May 27, 2026
47 of 61 checks passed
@lghiur
lghiur deleted the TT-17173-schema-security-requirement-scopes branch May 27, 2026 13:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@andrei-tyk andrei-tyk andrei-tyk approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@lghiur @andrei-tyk